[php-src] PR #24725: Add a fuzzer for ext/uri

From: Date: Mon, 26 Oct 2026 07:29:52 +0000
Subject: [php-src] PR #24725: Add a fuzzer for ext/uri
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39898@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24725 Author: yumasansansan ext/uri (PHP 8.5) is always built, but no fuzzer targets it. In the OSS-Fuzz coverage report of 2026-10-24, ext/uri/ (including the bundled uriparser) has 3.79% line coverage (325/8569, 30/451 functions), ext/lexbor/ 0.61%, and ext/standard/url.c 3.46%. php-fuzz-uri: - input: a URI, optionally followed by \n and a string for resolve() and the with*() methods. The WHATWG parser removes tabs and newlines from its input, so little is lost by using a newline as separator. - Uri\Rfc3986\Uri::parse() and Uri\WhatWg\Url::parse() (the latter with the $errors out parameter), then all getters, toString()/toRawString() or toAsciiString()/toUnicodeString(), __serialize(), __debugInfo(), equals(). - resolve() and each with*() method with the second part of the input; when they return an object, it is converted to a string. - parse_url() with the URI. - exceptions are discarded, so only sanitizer findings and assertions are reported. - a seed corpus of 21 URIs in sapi/fuzzer/corpus/uri (picked up by the OSS-Fuzz build.sh, which zips every directory in sapi/fuzzer/corpus). Replaying only the seed corpus (no fuzzing) reaches 91 functions of the ext/uri glue code, 69 functions of the bundled uriparser and 44 functions of lexbor's URL parser. ext/uri cannot be disabled, so the fuzzer is built unconditionally, like the JSON fuzzer.

« previous php.git-pulls (#39898) next »